Hi @Eva Shi
Thank you for reaching us!
I understand that you are unable to create key vault in AME tenant subscription. Based on the error message it seems that has restricted deny assignments.
To resolve this issue, I suggest you to please refer the article List Azure deny assignments.
Hope this helps. Do let us know if you any further queries by responding in the comments section.
Thanks,
Akhilesh.
If this answers your query, do click Accept Answer
and Yes
for was this answer helpful. And, if you have any further query do let us know.